tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public
History
Jiyong Park 04d2392c35 Don't use apexd when TARGET_FLATTEN_APEX == true 
/system/apex/com.android.runtime is labeled as runtime_apex_dir
and init is allowed to mount on it.

When TARGET_FLATTEN_APEX is true (= ro.apex.updatable is unset or set to
false), apexd is not used to activate the built-in flattened APEXes.
Init simply bind-mounts /system/apex to /apex.

However, there is a special case here. The runtime APEX is installed as
either /system/apex/com.android.runtime.debug or
/system/apex/com.android.runtime.release, whereas it should be activated
on /apex/com.android.runtime - without the .debug or .release suffix.
To handle that case, the build system creates an empty directory
/system/apex/com.android.runtime and the .debug or .release directory
is bind-mounted to the empty directory by init at runtime.

Bug: 132413565
Test: marlin is bootable
Merged-In: I3fde5ff831429723fecd1fa5c10e44f636a63f09
Change-Id: I3fde5ff831429723fecd1fa5c10e44f636a63f09
(cherry picked from commit 99902a175b)
2019-05-29 07:06:28 +09:00
..
adbd.te Allow adb start/stop mdnsd via ctl.start/stop 2019-04-16 08:39:33 -07:00
apexd.te Sepolicy: Allow crash_dump to ptrace apexd in userdebug 2019-03-05 09:59:50 -08:00
app.te Allow bootstrap bionic only to init, ueventd, and apexd 2019-04-11 09:51:38 +09:00
app_zygote.te Properly Treble-ize tmpfs access 2019-01-26 17:30:41 +00:00
asan_extract.te
ashmemd.te sepolicy for ashmemd 2019-02-05 21:38:14 +00:00
attributes Treble-ize sepolicy for fwk HIDL services. 2019-04-22 12:47:53 -07:00
audioserver.te Properly Treble-ize tmpfs access 2019-01-26 17:30:41 +00:00
blkid.te
blkid_untrusted.te
bluetooth.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
bootanim.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
bootstat.te Allow zygote to write to statsd and refactor 2018-10-08 13:48:28 -07:00
bufferhubd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
camera_service_server.te Abstract use of cameraserver behind an attribute 2019-03-01 14:02:59 -08:00
cameraserver.te Abstract use of cameraserver behind an attribute 2019-03-01 14:02:59 -08:00
charger.te Move /sbin/charger to /system/bin/charger. 2019-03-14 09:44:03 -07:00
crash_dump.te crash_dump: suppress denials on properties 2019-02-07 08:45:15 -08:00
device.te Add sepolicy for installing GSIs to external storage. 2019-03-27 17:12:51 -07:00
dhcp.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
display_service_server.te
dnsmasq.te dnsmasq - allow getattr on unix stream sockets 2019-05-03 06:16:57 +00:00
domain.te Add vendor_misc_writer. 2019-05-20 14:40:15 -07:00
drmserver.te Remove coredomain /dev access no longer needed after Treble 2018-11-29 04:56:18 +00:00
dumpstate.te selinux: Allow dumpstate send signals to vold 2019-05-21 20:39:07 +01:00
e2fs.te Allow e2fs more ioctls to device-mapper devices. 2019-02-05 18:05:50 -08:00
ephemeral_app.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
fastbootd.te super_block_device -> super_block_device_type 2019-03-28 18:08:19 +00:00
file.te Don't use apexd when TARGET_FLATTEN_APEX == true 2019-05-29 07:06:28 +09:00
fingerprintd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
flags_health_check.te Re-add sys_traced prop 2019-04-05 15:53:57 +00:00
fsck.te fs_mgr: overlayfs support legacy devices (marlin) Part Deux 2019-02-15 15:56:16 +00:00
fsck_untrusted.te
fwk_bufferhub.te Allow app to conntect to BufferHub service 2019-01-14 10:49:35 -08:00
gatekeeperd.te Allow gatekeeperd to read ro.gsid.image_running. 2019-02-19 21:08:22 +00:00
global_macros rs: add tests to ensure rs cannot abuse app data 2019-01-17 15:24:34 -08:00
gpuservice.te Game Driver: sepolicy update for plumbing GpuStats into GpuService 2019-02-08 18:15:17 -08:00
hal_allocator.te same_process_hal_file: access to individual coredomains 2018-10-26 18:03:01 +00:00
hal_atrace.te Add atrace HAL 1.0 sepolicy 2018-09-27 23:18:29 +00:00
hal_audio.te sepolicy: allow hal_omx to access audio devices 2019-04-10 11:31:04 -07:00
hal_audiocontrol.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_authsecret.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_bluetooth.te Add rules for accessing the related bluetooth_audio_hal_prop 2019-03-20 03:12:25 +00:00
hal_bootctl.te add hal_bootctl to white-list of sys_rawio 2019-02-13 12:38:22 +00:00
hal_broadcastradio.te Allow radio server to client binder callback 2019-03-29 15:22:16 -07:00
hal_camera.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_cas.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_configstore.te Allow heap profiling everything except TCB on userdebug. 2018-11-28 22:01:58 +00:00
hal_confirmationui.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_contexthub.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_drm.te More granular vendor access to /system files. 2018-09-20 03:07:50 +00:00
hal_dumpstate.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_evs.te Updates hal_evs sepolicy 2019-03-03 17:35:06 +00:00
hal_face.te Added placeholder SELinux policy for the biometric face HAL. 2018-12-28 12:23:56 -08:00
hal_fingerprint.te Revert "Add placeholder iris and face policy for vold data directory" 2018-11-19 15:00:19 -08:00
hal_gatekeeper.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_gnss.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_graphics_allocator.te same_process_hal_file: access to individual coredomains 2018-10-26 18:03:01 +00:00
hal_graphics_composer.te Initial selinux policy support for memfd 2019-01-30 19:11:49 +00:00
hal_health.te Allow to getattr kmsg_device 2019-03-25 10:14:20 -07:00
hal_health_storage.te health.filesystem HAL renamed to health.storage 2018-09-20 04:12:45 +00:00
hal_input_classifier.te Permissions for InputClassifier HAL 2019-01-11 02:08:19 +00:00
hal_ir.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_keymaster.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_light.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_lowpan.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_memtrack.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_neuralnetworks.te Allow NNAPI HAL services access model files provided by privapp. 2019-04-24 21:15:45 -07:00
hal_neverallows.te
hal_nfc.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_oemlock.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_omx.te add mediaswcodec service 2018-10-11 15:10:17 -07:00
hal_power.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_power_stats.te Add power.stats HAL 1.0 sepolicy 2018-12-11 00:11:08 +00:00
hal_secure_element.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_sensors.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_telephony.te Remove sepolicy for /dev/alarm. 2018-12-06 04:23:22 +00:00
hal_tetheroffload.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_thermal.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_tv_cec.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_tv_input.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_usb.te Allow hal_usb to call getsockopt on uevent socket 2018-12-03 18:37:25 +00:00
hal_usb_gadget.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_vehicle.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_vibrator.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_vr.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_weaver.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_wifi.te Allow dumpstate to dump wlan hal log on userbuild 2019-03-21 12:27:44 +08:00
hal_wifi_hostapd.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_wifi_offload.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_wifi_supplicant.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
healthd.te drop "allow healthd self:process execmem;" 2019-05-23 11:17:21 -07:00
heapprofd.te Add userdebug selinux config for heapprofd. 2018-11-14 09:22:07 +00:00
hwservice.te Add selinux rules for HIDL ICameraServer. 2019-03-01 14:01:07 -08:00
hwservicemanager.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
idmap.te Allow idmap1 to read vmdl*.tmp APK install files 2019-04-24 16:48:06 +00:00
incident.te
incident_helper.te
incidentd.te
init.te Don't use apexd when TARGET_FLATTEN_APEX == true 2019-05-29 07:06:28 +09:00
inputflinger.te SEPolicy for InputFlinger Service. 2018-11-16 21:52:01 +00:00
install_recovery.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
installd.te Allow installd to scan JARs in /vendor/framework. 2019-02-27 20:23:24 +00:00
ioctl_defines Allow fs-verity setup within system_server 2019-01-11 12:21:59 -08:00
ioctl_macros more ioctl work 2018-10-17 11:12:18 -07:00
iorapd.te iorapd: add tmpfs type 2019-01-26 12:55:13 -08:00
isolated_app.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
kernel.te Adding vendor_apex_file for /vendor/apex 2019-04-25 02:54:14 +09:00
keystore.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
llkd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
lmkd.te Add TODOs 2019-05-02 08:29:21 -07:00
logd.te Relabel /data/system/packages.list to new type. 2019-03-28 10:27:43 +00:00
logpersist.te Start partitioning off privapp_data_file from app_data_file 2018-08-02 16:29:02 -07:00
mdnsd.te
mediadrmserver.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
mediaextractor.te SEPolicy updates for adding native flag namespace(media). 2019-01-31 10:06:32 -08:00
mediametrics.te Allow mediametrics to log records to statsd 2019-02-25 20:09:54 -08:00
mediaprovider.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
mediaserver.te Allow mediaserver to find "audio" service 2019-04-22 14:52:17 -07:00
mediaswcodec.te SEPolicy updates for adding native flag namespace(media). 2019-01-31 10:06:32 -08:00
modprobe.te
mtp.te mtp: support using pppox_socket family 2019-05-08 01:16:38 -07:00
net.te netdomain: allow node_bind for ping sockets 2019-01-14 16:59:03 +00:00
netd.te sepolicy - move public clatd to private 2019-05-11 17:47:25 -07:00
netutils_wrapper.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
network_stack.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
neverallow_macros
nfc.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
perfetto.te Allow to signal perfetto from shell. 2018-12-13 10:46:42 +00:00
performanced.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
perfprofd.te same_process_hal_file: access to individual coredomains 2018-10-26 18:03:01 +00:00
platform_app.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
postinstall.te Allow postinstall scripts to trigger F2FS GC 2019-02-20 22:40:53 +00:00
ppp.te ppp: support using pppox_socket family 2019-05-06 12:57:51 -07:00
priv_app.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
profman.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
property.te Sepolicy: add dynamic_system_prop 2019-04-30 18:29:56 +08:00
property_contexts Set persist.sys.device_provisioned vendor-init-readable. 2019-05-20 10:44:04 -07:00
racoon.te racoon: allow ioctl TUNSETIFF 2018-11-15 10:32:45 -08:00
radio.te Radio: allow to read kernel command line. 2019-02-12 23:36:51 +00:00
recovery.te Fix selinux denials when applying updates in recovery. 2019-05-22 15:52:03 -07:00
recovery_persist.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
recovery_refresh.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
roles
rs.te sepolicy: Add "rs" and "rs_exec" to public policy 2018-12-21 17:47:54 +00:00
rss_hwm_reset.te SELinux policy for rss_hwm_reset 2018-12-15 10:13:03 +00:00
runas.te Relabel /data/system/packages.list to new type. 2019-03-28 10:27:43 +00:00
runas_app.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
scheduler_service_server.te Treble-ize sepolicy for fwk HIDL services. 2019-04-22 12:47:53 -07:00
sdcardd.te Relabel /data/system/packages.list to new type. 2019-03-28 10:27:43 +00:00
secure_element.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
sensor_service_server.te Treble-ize sepolicy for fwk HIDL services. 2019-04-22 12:47:53 -07:00
service.te revert ipmemorystore selinux policy. 2019-04-01 16:37:25 +09:00
servicemanager.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
sgdisk.te sgdisk: allow BLKRRPART 2018-11-02 14:26:23 -07:00
shared_relro.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
shell.te Sepolicy: add dynamic_system_prop 2019-04-30 18:29:56 +08:00
simpleperf_app_runner.te Relabel /data/system/packages.list to new type. 2019-03-28 10:27:43 +00:00
slideshow.te
stats_service_server.te Treble-ize sepolicy for fwk HIDL services. 2019-04-22 12:47:53 -07:00
statsd.te Treble-ize sepolicy for fwk HIDL services. 2019-04-22 12:47:53 -07:00
su.te dontaudit su unlabeled:vsock_socket * 2019-05-06 14:36:39 -07:00
surfaceflinger.te Initial selinux policy support for memfd 2019-01-30 19:11:49 +00:00
swcodec_service_server.te add mediaswcodec service 2018-10-11 15:10:17 -07:00
system_app.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
system_server.te Initial selinux policy support for memfd 2019-01-30 19:11:49 +00:00
system_suspend_server.te Decouple system_suspend from hal attributes. 2019-02-26 18:10:28 -08:00
te_macros Allow profilable domains to use heapprofd fd and tmpfs. 2019-03-04 12:05:35 +00:00
tee.te Revert "Add placeholder iris and face policy for vold data directory" 2018-11-19 15:00:19 -08:00
thermalserviced.te Revert "Move thermal service into system_server" 2018-12-11 17:04:17 +00:00
tombstoned.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
toolbox.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
traced.te Allow iorapd to access perfetto 2019-01-23 22:43:47 +00:00
traced_probes.te
traceur_app.te Add selinux rule to allow Traceur to enable the traced daemon. 2019-04-26 16:18:56 -07:00
tzdatacheck.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
ueventd.te Allow bootstrap bionic only to init, ueventd, and apexd 2019-04-11 09:51:38 +09:00
uncrypt.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
untrusted_app.te Remove unused *_tmpfs types 2019-01-30 21:54:40 +00:00
update_engine.te Allow to getattr kmsg_device 2019-03-25 10:14:20 -07:00
update_engine_common.te super_block_device -> super_block_device_type 2019-03-28 18:08:19 +00:00
update_verifier.te Allow to getattr kmsg_device 2019-03-25 10:14:20 -07:00
usbd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
vdc.te Allow to getattr kmsg_device 2019-03-25 10:14:20 -07:00
vendor_init.te Allow bootstrap bionic only to init, ueventd, and apexd 2019-04-11 09:51:38 +09:00
vendor_misc_writer.te Add vendor_misc_writer. 2019-05-20 14:40:15 -07:00
vendor_shell.te
vendor_toolbox.te
virtual_touchpad.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
vndservice.te
vndservicemanager.te
vold.te sepolicy: add sepolicy rules for vold to write sysfs gc_urgent 2019-03-24 13:19:46 +08:00
vold_prepare_subdirs.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
vr_hwc.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
watchdogd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
webview_zygote.te Properly Treble-ize tmpfs access 2019-01-26 17:30:41 +00:00
wificond.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
wpantund.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
zygote.te Properly Treble-ize tmpfs access 2019-01-26 17:30:41 +00:00